-
Notifications
You must be signed in to change notification settings - Fork 3
/
winternl.h
executable file
·515 lines (515 loc) · 40.5 KB
/
winternl.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
NTSYSAPI NTSTATUS WINAPI LdrAccessResource(HMODULE,IMAGE_RESOURCE_DATA_ENTRY*,void**,PULONG);
NTSYSAPI NTSTATUS WINAPI LdrAddRefDll(ULONG,HMODULE);
NTSYSAPI NTSTATUS WINAPI LdrFindResourceDirectory_U(HMODULE,LDR_RESOURCE_INFO*,ULONG,IMAGE_RESOURCE_DIRECTORY**);
NTSYSAPI NTSTATUS WINAPI LdrFindResource_U(HMODULE,LDR_RESOURCE_INFO*,ULONG,IMAGE_RESOURCE_DATA_ENTRY**);
NTSYSAPI NTSTATUS WINAPI LdrDisableThreadCalloutsForDll(HMODULE);
NTSYSAPI NTSTATUS WINAPI LdrFindEntryForAddress(void*, PLDR_MODULE*);
NTSYSAPI NTSTATUS WINAPI LdrGetDllHandle(LPCWSTR, ULONG, UNICODE_STRING*, HMODULE*);
NTSYSAPI NTSTATUS WINAPI LdrGetProcedureAddress(HMODULE, ANSI_STRING*, ULONG, void**);
NTSYSAPI void WINAPI LdrInitializeThunk(ULONG,ULONG,ULONG,ULONG);
NTSYSAPI NTSTATUS WINAPI LdrLoadDll(LPCWSTR, DWORD, UNICODE_STRING*, HMODULE*);
NTSYSAPI NTSTATUS WINAPI LdrLockLoaderLock(ULONG,ULONG*,ULONG*);
NTSYSAPI NTSTATUS WINAPI LdrQueryProcessModuleInformation(SYSTEM_MODULE_INFORMATION*, ULONG, ULONG*);
NTSYSAPI void WINAPI LdrShutdownProcess(void);
NTSYSAPI void WINAPI LdrShutdownThread(void);
NTSYSAPI NTSTATUS WINAPI LdrUnloadDll(HMODULE);
NTSYSAPI NTSTATUS WINAPI LdrUnlockLoaderLock(ULONG,ULONG);
NTSYSAPI NTSTATUS WINAPI NtAcceptConnectPort(PHANDLE,ULONG,PLPC_MESSAGE,BOOLEAN,PLPC_SECTION_WRITE,PLPC_SECTION_READ);
NTSYSAPI NTSTATUS WINAPI NtAccessCheck(PSECURITY_DESCRIPTOR,HANDLE,ACCESS_MASK,PGENERIC_MAPPING,PPRIVILEGE_SET,PULONG,PULONG,NTSTATUS*);
NTSYSAPI NTSTATUS WINAPI NtAccessCheckAndAuditAlarm(PUNICODE_STRING,HANDLE,PUNICODE_STRING,PUNICODE_STRING,PSECURITY_DESCRIPTOR,ACCESS_MASK,PGENERIC_MAPPING,BOOLEAN,PACCESS_MASK,PBOOLEAN,PBOOLEAN);
NTSYSAPI NTSTATUS WINAPI NtAddAtom(WCHAR*,ULONG,RTL_ATOM*);
NTSYSAPI NTSTATUS WINAPI NtAdjustGroupsToken(HANDLE,BOOLEAN,PTOKEN_GROUPS,ULONG,PTOKEN_GROUPS,PULONG);
NTSYSAPI NTSTATUS WINAPI NtAdjustPrivilegesToken(HANDLE,BOOLEAN,PTOKEN_PRIVILEGES,DWORD,PTOKEN_PRIVILEGES,PDWORD);
NTSYSAPI NTSTATUS WINAPI NtAlertResumeThread(HANDLE,PULONG);
NTSYSAPI NTSTATUS WINAPI NtAlertThread(HANDLE ThreadHandle);
NTSYSAPI NTSTATUS WINAPI NtAllocateLocallyUniqueId(PLUID lpLuid);
NTSYSAPI NTSTATUS WINAPI NtAllocateUuids(PULARGE_INTEGER,PULONG,PULONG);
NTSYSAPI NTSTATUS WINAPI NtAllocateVirtualMemory(HANDLE,void**,ULONG,SIZE_T*,ULONG,ULONG);
NTSYSAPI NTSTATUS WINAPI NtAreMappedFilesTheSame(void*,void*);
NTSYSAPI NTSTATUS WINAPI NtCallbackReturn(void*,ULONG,NTSTATUS);
NTSYSAPI NTSTATUS WINAPI NtCancelIoFile(HANDLE,PIO_STATUS_BLOCK);
NTSYSAPI NTSTATUS WINAPI NtCancelTimer(HANDLE, BOOLEAN*);
NTSYSAPI NTSTATUS WINAPI NtClearEvent(HANDLE);
NTSYSAPI NTSTATUS WINAPI NtClose(HANDLE);
NTSYSAPI NTSTATUS WINAPI NtCloseObjectAuditAlarm(PUNICODE_STRING,HANDLE,BOOLEAN);
NTSYSAPI NTSTATUS WINAPI NtCompleteConnectPort(HANDLE);
NTSYSAPI NTSTATUS WINAPI NtConnectPort(PHANDLE,PUNICODE_STRING,PSECURITY_QUALITY_OF_SERVICE,PLPC_SECTION_WRITE,PLPC_SECTION_READ,PULONG,void*,PULONG);
NTSYSAPI NTSTATUS WINAPI NtContinue(PCONTEXT,BOOLEAN);
NTSYSAPI NTSTATUS WINAPI NtCreateDirectoryObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
NTSYSAPI NTSTATUS WINAPI NtCreateEvent(PHANDLE,ACCESS_MASK,OBJECT_ATTRIBUTE,BOOLEAN,BOOLEAN);
NTSYSAPI NTSTATUS WINAPI NtCreateEventPair(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
NTSYSAPI NTSTATUS WINAPI NtCreateFile(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,PLARGE_INTEGER,ULONG,ULONG,ULONG,ULONG,void*,ULONG);
NTSYSAPI NTSTATUS WINAPI NtCreateIoCompletion(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,ULONG);
NTSYSAPI NTSTATUS WINAPI NtCreateKey(PHANDLE,ACCESS_MASK,OBJECT_ATTRIBUTES*,ULONG,UNICODE_STRING*,ULONG,PULONG);
NTSYSAPI NTSTATUS WINAPI NtCreateMailslotFile(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,ULONG,ULONG,ULONG,PLARGE_INTEGER);
NTSYSAPI NTSTATUS WINAPI NtCreateMutant(PHANDLE,ACCESS_MASK,OBJECT_ATTRIBUTES*,BOOLEAN);
NTSYSAPI NTSTATUS WINAPI NtCreateNamedPipeFile(PHANDLE,ULONG,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,ULONG,ULONG,ULONG,ULONG,ULONG,ULONG,ULONG,ULONG,ULONG,PLARGE_INTEGER);
NTSYSAPI NTSTATUS WINAPI NtCreatePagingFile(PUNICODE_STRING,PLARGE_INTEGER,PLARGE_INTEGER,PLARGE_INTEGER);
NTSYSAPI NTSTATUS WINAPI NtCreatePort(PHANDLE,POBJECT_ATTRIBUTES,ULONG,ULONG,PULONG);
NTSYSAPI NTSTATUS WINAPI NtCreateProcess(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,HANDLE,BOOLEAN,HANDLE,HANDLE,HANDLE);
NTSYSAPI NTSTATUS WINAPI NtCreateProcessEx(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,HANDLE,ULONG,HANDLE,HANDLE,HANDLE,ULONG);
NTSYSAPI NTSTATUS WINAPI NtCreateProfile(PHANDLE,HANDLE,void*,ULONG,ULONG,void*,ULONG,KPROFILE_SOURCE,KAFFINITY);
NTSYSAPI NTSTATUS WINAPI NtCreateSection(PHANDLE,ACCESS_MASK,OBJECT_ATTRIBUTES*,LARGE_INTEGER*,ULONG,ULONG,HANDLE);
NTSYSAPI NTSTATUS WINAPI NtCreateSemaphore(PHANDLE,ACCESS_MASK,OBJECT_ATTRIBUTES*,LONG,LONG);
NTSYSAPI NTSTATUS WINAPI NtCreateSymbolicLinkObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PUNICODE_STRING);
NTSYSAPI NTSTATUS WINAPI NtCreateThread(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,HANDLE,PCLIENT_ID,PCONTEXT,PINITIAL_TEB,BOOLEAN);
NTSYSAPI NTSTATUS WINAPI NtCreateTimer(PHANDLE, ACCESS_MASK, OBJECT_ATTRIBUTES*, TIMER_TYPE);
NTSYSAPI NTSTATUS WINAPI NtCreateToken(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,TOKEN_TYPE,PLUID,PLARGE_INTEGER,PTOKEN_USER,PTOKEN_GROUPS,PTOKEN_PRIVILEGES,PTOKEN_OWNER,PTOKEN_PRIMARY_GROUP,PTOKEN_DEFAULT_DACL,PTOKEN_SOURCE);
NTSYSAPI NTSTATUS WINAPI NtDelayExecution(BOOLEAN,LARGE_INTEGER*);
NTSYSAPI NTSTATUS WINAPI NtDeleteAtom(RTL_ATOM);
NTSYSAPI NTSTATUS WINAPI NtDeleteFile(POBJECT_ATTRIBUTES);
NTSYSAPI NTSTATUS WINAPI NtDeleteKey(HANDLE);
NTSYSAPI NTSTATUS WINAPI NtDeleteValueKey(HANDLE,PUNICODE_STRING);
NTSYSAPI NTSTATUS WINAPI NtDeviceIoControlFile(HANDLE,HANDLE,PIO_APC_ROUTINE,void*,PIO_STATUS_BLOCK,ULONG,void*,ULONG,void*,ULONG);
NTSYSAPI NTSTATUS WINAPI NtDisplayString(PUNICODE_STRING);
NTSYSAPI NTSTATUS WINAPI NtDuplicateObject(HANDLE,HANDLE,HANDLE,PHANDLE,ACCESS_MASK,ULONG,ULONG);
NTSYSAPI NTSTATUS WINAPI NtDuplicateToken(HANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,SECURITY_IMPERSONATION_LEVEL,TOKEN_TYPE,PHANDLE);
NTSYSAPI NTSTATUS WINAPI NtEnumerateKey(HANDLE,ULONG,KEY_INFORMATION_CLASS,voi,DWORD,DWORD*);
NTSYSAPI NTSTATUS WINAPI NtEnumerateValueKey(HANDLE,ULONG,KEY_VALUE_INFORMATION_CLASS,void*,ULONG,PULONG);
NTSYSAPI NTSTATUS WINAPI NtExtendSection(HANDLE,PLARGE_INTEGER);
NTSYSAPI NTSTATUS WINAPI NtFindAtom(WCHAR*,ULONG,RTL_ATOM*);
NTSYSAPI NTSTATUS WINAPI NtFlushBuffersFile(HANDLE,IO_STATUS_BLOCK*);
NTSYSAPI NTSTATUS WINAPI NtFlushInstructionCache(HANDLE,void*,SIZE_T);
NTSYSAPI NTSTATUS WINAPI NtFlushKey(HANDLE);
NTSYSAPI NTSTATUS WINAPI NtFlushVirtualMemory(HANDLE,void**,SIZE_T*,ULONG);
NTSYSAPI NTSTATUS WINAPI NtFlushWriteBuffer(VOID);
NTSYSAPI NTSTATUS WINAPI NtFreeVirtualMemory(HANDLE,void**,SIZE_T*,ULONG);
NTSYSAPI NTSTATUS WINAPI NtFsControlFile(HANDLE,HANDLE,PIO_APC_ROUTINE,void*,PIO_STATUS_BLOCK,ULONG,void*,ULONG,void*,ULONG);
NTSYSAPI NTSTATUS WINAPI NtGetContextThread(HANDLE,CONTEXT*);
NTSYSAPI NTSTATUS WINAPI NtGetPlugPlayEvent(ULONG,ULONG,void*,ULONG);
NTSYSAPI ULONG WINAPI NtGetTickCount(VOID);
NTSYSAPI NTSTATUS WINAPI NtImpersonateAnonymousToken(HANDLE);
NTSYSAPI NTSTATUS WINAPI NtImpersonateClientOfPort(HANDLE,PPORT_MESSAGE);
NTSYSAPI NTSTATUS WINAPI NtImpersonateThread(HANDLE,HANDLE,PSECURITY_QUALITY_OF_SERVICE);
NTSYSAPI NTSTATUS WINAPI NtInitializeRegistry(BOOLEAN);
NTSYSAPI NTSTATUS WINAPI NtInitiatePowerAction(POWER_ACTION,SYSTEM_POWER_STATE,ULONG,BOOLEAN);
NTSYSAPI NTSTATUS WINAPI NtListenPort(HANDLE,PLPC_MESSAGE);
NTSYSAPI NTSTATUS WINAPI NtLoadDriver(PUNICODE_STRING);
NTSYSAPI NTSTATUS WINAPI NtLoadKey(OBJECT_ATTRIBUTE,OBJECT_ATTRIBUTES*);
NTSYSAPI NTSTATUS WINAPI NtLockFile(HANDLE,HANDLE,PIO_APC_ROUTINE,void*,PIO_STATUS_BLOCK,PLARGE_INTEGER,PLARGE_INTEGER,ULONG*,BOOLEAN,BOOLEAN);
NTSYSAPI NTSTATUS WINAPI NtLockVirtualMemory(HANDLE,void**,SIZE_T*,ULONG);
NTSYSAPI NTSTATUS WINAPI NtMakeTemporaryObject(HANDLE);
NTSYSAPI NTSTATUS WINAPI NtMapViewOfSection(HANDLE,HANDLE,void**,ULONG,SIZE_T,LARGE_INTEGER*,SIZE_T*,SECTION_INHERIT,ULONG,ULONG);
NTSYSAPI NTSTATUS WINAPI NtNotifyChangeDirectoryFile(HANDLE,HANDLE,PIO_APC_ROUTINE,void*,PIO_STATUS_BLOCK,void*,ULONG,ULONG,BOOLEAN);
NTSYSAPI NTSTATUS WINAPI NtNotifyChangeKey(HANDLE,HANDLE,PIO_APC_ROUTINE,void*,PIO_STATUS_BLOCK,ULONG,BOOLEAN,void*,ULONG,BOOLEAN);
NTSYSAPI NTSTATUS WINAPI NtOpenDirectoryObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
NTSYSAPI NTSTATUS WINAPI NtOpenEvent(PHANDLE,ACCESS_MASK,OBJECT_ATTRIBUTE);
NTSYSAPI NTSTATUS WINAPI NtOpenEventPair(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
NTSYSAPI NTSTATUS WINAPI NtOpenFile(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,ULONG,ULONG);
NTSYSAPI NTSTATUS WINAPI NtOpenIoCompletion(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
NTSYSAPI NTSTATUS WINAPI NtOpenKey(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
NTSYSAPI NTSTATUS WINAPI NtOpenKeyedEvent(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
NTSYSAPI NTSTATUS WINAPI NtOpenMutant(PHANDLE,ACCESS_MASK,OBJECT_ATTRIBUTES*);
NTSYSAPI NTSTATUS WINAPI NtOpenObjectAuditAlarm(PUNICODE_STRING,PHANDLE,PUNICODE_STRING,PUNICODE_STRING,PSECURITY_DESCRIPTOR,HANDLE,ACCESS_MASK,ACCESS_MASK,PPRIVILEGE_SET,BOOLEAN,BOOLEAN,PBOOLEAN);
NTSYSAPI NTSTATUS WINAPI NtOpenProcess(PHANDLE,ACCESS_MASK,OBJECT_ATTRIBUTES*,CLIENT_ID*);
NTSYSAPI NTSTATUS WINAPI NtOpenProcessToken(HANDLE,DWORD,HANDL);
NTSYSAPI NTSTATUS WINAPI NtOpenProcessTokenEx(HANDLE,ACCESS_MASK,ULONG,PHANDLE);
NTSYSAPI NTSTATUS WINAPI NtOpenSection(PHANDLE,ACCESS_MASK,OBJECT_ATTRIBUTES*);
NTSYSAPI NTSTATUS WINAPI NtOpenSemaphore(PHANDLE,ACCESS_MASK,OBJECT_ATTRIBUTES*);
NTSYSAPI NTSTATUS WINAPI NtOpenSymbolicLinkObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
NTSYSAPI NTSTATUS WINAPI NtOpenThread(PHANDLE,ACCESS_MASK,OBJECT_ATTRIBUTES*,CLIENT_ID*);
NTSYSAPI NTSTATUS WINAPI NtOpenThreadToken(HANDLE,DWORD,BOOLEAN,HANDL);
NTSYSAPI NTSTATUS WINAPI NtOpenThreadTokenEx(HANDLE,ACCESS_MASK,BOOLEAN,ULONG,PHANDLE);
NTSYSAPI NTSTATUS WINAPI NtOpenTimer(PHANDLE, ACCESS_MASK, OBJECT_ATTRIBUTES*);
NTSYSAPI NTSTATUS WINAPI NtPowerInformation(POWER_INFORMATION_LEVEL,void*,ULONG,void*,ULONG);
NTSYSAPI NTSTATUS WINAPI NtPrivilegeCheck(HANDLE,PPRIVILEGE_SET,PBOOLEAN);
NTSYSAPI NTSTATUS WINAPI NtPrivilegeObjectAuditAlarm(PUNICODE_STRING,HANDLE,HANDLE,ULONG,PPRIVILEGE_SET,BOOLEAN);
NTSYSAPI NTSTATUS WINAPI NtPrivilegedServiceAuditAlarm(PUNICODE_STRING,PUNICODE_STRING,HANDLE,PPRIVILEGE_SET,BOOLEAN);
NTSYSAPI NTSTATUS WINAPI NtProtectVirtualMemory(HANDLE,void**,SIZE_T*,ULONG,ULONG*);
NTSYSAPI NTSTATUS WINAPI NtPulseEvent(HANDLE,PULONG);
NTSYSAPI NTSTATUS WINAPI NtQueueApcThread(HANDLE,PNTAPCFUNC,ULONG_PTR,ULONG_PTR,ULONG_PTR);
NTSYSAPI NTSTATUS WINAPI NtQueryAttributesFile(OBJECT_ATTRIBUTES*,FILE_BASIC_INFORMATION*);
NTSYSAPI NTSTATUS WINAPI NtQueryDefaultLocale(BOOLEAN,LCID*);
NTSYSAPI NTSTATUS WINAPI NtQueryDefaultUILanguage(LANGID*);
NTSYSAPI NTSTATUS WINAPI NtQueryDebugFilterState(ULONG,ULONG);
NTSYSAPI NTSTATUS WINAPI NtQueryDirectoryFile(HANDLE,HANDLE,PIO_APC_ROUTINE,void*,PIO_STATUS_BLOCK,void*,ULONG,FILE_INFORMATION_CLASS,BOOLEAN,PUNICODE_STRING,BOOLEAN);
NTSYSAPI NTSTATUS WINAPI NtQueryDirectoryObject(HANDLE,PDIRECTORY_BASIC_INFORMATION,ULONG,BOOLEAN,BOOLEAN,PULONG,PULONG);
NTSYSAPI NTSTATUS WINAPI NtQueryEaFile(HANDLE,PIO_STATUS_BLOCK,void*,ULONG,BOOLEAN,void*,ULONG,void*,BOOLEAN);
NTSYSAPI NTSTATUS WINAPI NtQueryEvent(HANDLE,EVENT_INFORMATION_CLASS,void*,ULONG,PULONG);
NTSYSAPI NTSTATUS WINAPI NtQueryFullAttributesFile(OBJECT_ATTRIBUTES*,FILE_NETWORK_OPEN_INFORMATION*);
NTSYSAPI NTSTATUS WINAPI NtQueryInformationAtom(RTL_ATOM,ATOM_INFORMATION_CLASS,void*,ULONG,ULONG*);
NTSYSAPI NTSTATUS WINAPI NtQueryInformationFile(HANDLE,PIO_STATUS_BLOCK,void*,LONG,FILE_INFORMATION_CLASS);
NTSYSAPI NTSTATUS WINAPI NtQueryInformationPort(HANDLE,PORT_INFORMATION_CLASS,void*,ULONG,PULONG);
NTSYSAPI NTSTATUS WINAPI NtQueryInformationProcess(HANDLE,PROCESSINFOCLASS,void*,ULONG,PULONG);
NTSYSAPI NTSTATUS WINAPI NtQueryInformationThread(HANDLE,THREADINFOCLASS,void*,ULONG,PULONG);
NTSYSAPI NTSTATUS WINAPI NtQueryInformationToken(HANDLE,TOKEN_INFORMATION_CLASS,void*,ULONG,PULONG);
NTSYSAPI NTSTATUS WINAPI NtQueryInformationJobObject(HANDLE,JOBOBJECTINFOCLASS,void*,ULONG,PULONG);
NTSYSAPI NTSTATUS WINAPI NtQueryInstallUILanguage(LANGID*);
NTSYSAPI NTSTATUS WINAPI NtQueryIntervalProfile(KPROFILE_SOURCE,PULONG);
NTSYSAPI NTSTATUS WINAPI NtQueryIoCompletion(HANDLE,IO_COMPLETION_INFORMATION_CLASS,void*,ULONG,PULONG);
NTSYSAPI NTSTATUS WINAPI NtQueryKey(HANDLE,KEY_INFORMATION_CLASS,void*,DWORD,DWORD*);
NTSYSAPI NTSTATUS WINAPI NtQueryMultipleValueKey(HANDLE,PKEY_MULTIPLE_VALUE_INFORMATION,ULONG,void*,ULONG,PULONG);
NTSYSAPI NTSTATUS WINAPI NtQueryMutant(HANDLE,MUTANT_INFORMATION_CLASS,void*,ULONG,PULONG);
NTSYSAPI NTSTATUS WINAPI NtQueryObject(HANDLE, OBJECT_INFORMATION_CLASS, void*, ULONG, PULONG);
NTSYSAPI NTSTATUS WINAPI NtQueryOpenSubKeys(POBJECT_ATTRIBUTES,PULONG);
NTSYSAPI NTSTATUS WINAPI NtQueryPerformanceCounter(PLARGE_INTEGER, PLARGE_INTEGER);
NTSYSAPI NTSTATUS WINAPI NtQuerySecurityObject(HANDLE,SECURITY_INFORMATION,PSECURITY_DESCRIPTOR,ULONG,PULONG);
NTSYSAPI NTSTATUS WINAPI NtQuerySection(HANDLE,SECTION_INFORMATION_CLASS,void*,ULONG,PULONG);
NTSYSAPI NTSTATUS WINAPI NtQuerySemaphore(HANDLE,SEMAPHORE_INFORMATION_CLASS,void*,ULONG,PULONG);
NTSYSAPI NTSTATUS WINAPI NtQuerySymbolicLinkObject(HANDLE,PUNICODE_STRING,PULONG);
NTSYSAPI NTSTATUS WINAPI NtQuerySystemEnvironmentValue(PUNICODE_STRING,PWCHAR,ULONG,PULONG);
NTSYSAPI NTSTATUS WINAPI NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS,void*,ULONG,PULONG);
NTSYSAPI NTSTATUS WINAPI NtQuerySystemTime(PLARGE_INTEGER);
NTSYSAPI NTSTATUS WINAPI NtQueryTimer(HANDLE,TIMER_INFORMATION_CLASS,void*,ULONG,PULONG);
NTSYSAPI NTSTATUS WINAPI NtQueryTimerResolution(PULONG,PULONG,PULONG);
NTSYSAPI NTSTATUS WINAPI NtQueryValueKey(HANDLE,PUNICODE_STRING,KEY_VALUE_INFORMATION_CLASS,void*,DWORD,DWORD*);
NTSYSAPI NTSTATUS WINAPI NtQueryVirtualMemory(HANDLE,void*,MEMORY_INFORMATION_CLASS,void*,SIZE_T,SIZE_T*);
NTSYSAPI NTSTATUS WINAPI NtQueryVolumeInformationFile(HANDLE,PIO_STATUS_BLOCK,void*,ULONG,FS_INFORMATION_CLASS);
NTSYSAPI NTSTATUS WINAPI NtRaiseException(PEXCEPTION_RECORD,PCONTEXT,BOOL);
NTSYSAPI NTSTATUS WINAPI NtRaiseHardError(NTSTATUS,ULONG,PUNICODE_STRING,void**,HARDERROR_RESPONSE_OPTION,PHARDERROR_RESPONSE);
NTSYSAPI NTSTATUS WINAPI NtReadFile(HANDLE,HANDLE,PIO_APC_ROUTINE,void*,PIO_STATUS_BLOCK,void*,ULONG,PLARGE_INTEGER,PULONG);
NTSYSAPI NTSTATUS WINAPI NtReadFileScatter(HANDLE,HANDLE,PIO_APC_ROUTINE,void*,PIO_STATUS_BLOCK,FILE_SEGMENT_ELEMENT,ULONG,PLARGE_INTEGER,PULONG);
NTSYSAPI NTSTATUS WINAPI NtReadRequestData(HANDLE,PLPC_MESSAGE,ULONG,void*,ULONG,PULONG);
NTSYSAPI NTSTATUS WINAPI NtReadVirtualMemory(HANDLE,void*,void*,SIZE_T,SIZE_T*);
NTSYSAPI NTSTATUS WINAPI NtRegisterThreadTerminatePort(HANDLE);
NTSYSAPI NTSTATUS WINAPI NtReleaseMutant(HANDLE,PLONG);
NTSYSAPI NTSTATUS WINAPI NtReleaseSemaphore(HANDLE,ULONG,PULONG);
NTSYSAPI NTSTATUS WINAPI NtRemoveIoCompletion(HANDLE,PULONG_PTR,PULONG_PTR,PIO_STATUS_BLOCK,PLARGE_INTEGER);
NTSYSAPI NTSTATUS WINAPI NtReplaceKey(POBJECT_ATTRIBUTES,HANDLE,POBJECT_ATTRIBUTES);
NTSYSAPI NTSTATUS WINAPI NtReplyPort(HANDLE,PLPC_MESSAGE);
NTSYSAPI NTSTATUS WINAPI NtReplyWaitReceivePort(HANDLE,PULONG,PLPC_MESSAGE,PLPC_MESSAGE);
NTSYSAPI NTSTATUS WINAPI NtReplyWaitReceivePortEx(HANDLE,void**,PPORT_MESSAGE,PPORT_MESSAGE,PLARGE_INTEGER);
NTSYSAPI NTSTATUS WINAPI NtReplyWaitReplyPort(HANDLE,PLPC_MESSAGE);
NTSYSAPI NTSTATUS WINAPI NtRequestPort(HANDLE,PLPC_MESSAGE);
NTSYSAPI NTSTATUS WINAPI NtRequestWaitReplyPort(HANDLE,PLPC_MESSAGE,PLPC_MESSAGE);
NTSYSAPI NTSTATUS WINAPI NtResetEvent(HANDLE,PULONG);
NTSYSAPI NTSTATUS WINAPI NtRestoreKey(HANDLE,HANDLE,ULONG);
NTSYSAPI NTSTATUS WINAPI NtResumeThread(HANDLE,PULONG);
NTSYSAPI NTSTATUS WINAPI NtSaveKey(HANDLE,HANDLE);
NTSYSAPI NTSTATUS WINAPI NtSecureConnectPort(PHANDLE,PUNICODE_STRING,PSECURITY_QUALITY_OF_SERVICE,PLPC_SECTION_WRITE,PSID,PLPC_SECTION_READ,PULONG,void*,PULONG);
NTSYSAPI NTSTATUS WINAPI NtSetContextThread(HANDLE,CONTEXT*);
NTSYSAPI NTSTATUS WINAPI NtSetDefaultHardErrorPort(HANDLE);
NTSYSAPI NTSTATUS WINAPI NtSetDefaultLocale(BOOLEAN,LCID);
NTSYSAPI NTSTATUS WINAPI NtSetDefaultUILanguage(LANGID);
NTSYSAPI NTSTATUS WINAPI NtSetEaFile(HANDLE,PIO_STATUS_BLOCK,void*,ULONG);
NTSYSAPI NTSTATUS WINAPI NtSetEvent(HANDLE,PULONG);
NTSYSAPI NTSTATUS WINAPI NtSetEventBoostPriority(HANDLE);
NTSYSAPI NTSTATUS WINAPI NtSetHighEventPair(HANDLE);
NTSYSAPI NTSTATUS WINAPI NtSetHighWaitLowEventPair(HANDLE);
NTSYSAPI NTSTATUS WINAPI NtSetHighWaitLowThread(VOID);
NTSYSAPI NTSTATUS WINAPI NtSetInformationFile(HANDLE,PIO_STATUS_BLOCK,void*,ULONG,FILE_INFORMATION_CLASS);
NTSYSAPI NTSTATUS WINAPI NtSetInformationKey(HANDLE,int,void*,ULONG);
NTSYSAPI NTSTATUS WINAPI NtSetInformationObject(HANDLE, OBJECT_INFORMATION_CLASS, void*, ULONG);
NTSYSAPI NTSTATUS WINAPI NtSetInformationProcess(HANDLE,PROCESS_INFORMATION_CLASS,void*,ULONG);
NTSYSAPI NTSTATUS WINAPI NtSetInformationThread(HANDLE,THREADINFOCLASS,void*,ULONG);
NTSYSAPI NTSTATUS WINAPI NtSetInformationToken(HANDLE,TOKEN_INFORMATION_CLASS,void*,ULONG);
NTSYSAPI NTSTATUS WINAPI NtSetIntervalProfile(ULONG,KPROFILE_SOURCE);
NTSYSAPI NTSTATUS WINAPI NtSetIoCompletion(HANDLE,ULONG_PTR,ULONG_PTR,NTSTATUS,ULONG);
NTSYSAPI NTSTATUS WINAPI NtSetLdtEntries(ULONG,LDT_ENTRY,ULONG,LDT_ENTRY);
NTSYSAPI NTSTATUS WINAPI NtSetLowEventPair(HANDLE);
NTSYSAPI NTSTATUS WINAPI NtSetLowWaitHighEventPair(HANDLE);
NTSYSAPI NTSTATUS WINAPI NtSetLowWaitHighThread(VOID);
NTSYSAPI NTSTATUS WINAPI NtSetSecurityObject(HANDLE,SECURITY_INFORMATION,PSECURITY_DESCRIPTOR);
NTSYSAPI NTSTATUS WINAPI NtSetSystemEnvironmentValue(PUNICODE_STRING,PUNICODE_STRING);
NTSYSAPI NTSTATUS WINAPI NtSetSystemInformation(SYSTEM_INFORMATION_CLASS,void*,ULONG);
NTSYSAPI NTSTATUS WINAPI NtSetSystemPowerState(POWER_ACTION,SYSTEM_POWER_STATE,ULONG);
NTSYSAPI NTSTATUS WINAPI NtSetSystemTime(LARGE_INTEGER*,LARGE_INTEGER*);
NTSYSAPI NTSTATUS WINAPI NtSetTimer(HANDLE, LARGE_INTEGER*, PTIMER_APC_ROUTINE, void*, BOOLEAN, ULONG, BOOLEAN*);
NTSYSAPI NTSTATUS WINAPI NtSetTimerResolution(ULONG,BOOLEAN,PULONG);
NTSYSAPI NTSTATUS WINAPI NtSetValueKey(HANDLE,UNICODE_STRING,ULONG,ULONG,void*,ULONG);
NTSYSAPI NTSTATUS WINAPI NtSetVolumeInformationFile(HANDLE,PIO_STATUS_BLOCK,void*,ULONG,FS_INFORMATION_CLASS);
NTSYSAPI NTSTATUS WINAPI NtSignalAndWaitForSingleObject(HANDLE,HANDLE,BOOLEAN,LARGE_INTEGER*);
NTSYSAPI NTSTATUS WINAPI NtShutdownSystem(SHUTDOWN_ACTION);
NTSYSAPI NTSTATUS WINAPI NtStartProfile(HANDLE);
NTSYSAPI NTSTATUS WINAPI NtStopProfile(HANDLE);
NTSYSAPI NTSTATUS WINAPI NtSuspendThread(HANDLE,PULONG);
NTSYSAPI NTSTATUS WINAPI NtSystemDebugControl(SYSDBG_COMMAND,void*,ULONG,void*,ULONG,PULONG);
NTSYSAPI NTSTATUS WINAPI NtTerminateProcess(HANDLE,LONG);
NTSYSAPI NTSTATUS WINAPI NtTerminateThread(HANDLE,LONG);
NTSYSAPI NTSTATUS WINAPI NtTestAlert(VOID);
NTSYSAPI NTSTATUS WINAPI NtUnloadDriver(PUNICODE_STRING);
NTSYSAPI NTSTATUS WINAPI NtUnloadKey(POBJECT_ATTRIBUTES);
NTSYSAPI NTSTATUS WINAPI NtUnloadKeyEx(POBJECT_ATTRIBUTES,HANDLE);
NTSYSAPI NTSTATUS WINAPI NtUnlockFile(HANDLE,PIO_STATUS_BLOCK,PLARGE_INTEGER,PLARGE_INTEGER,PULONG);
NTSYSAPI NTSTATUS WINAPI NtUnlockVirtualMemory(HANDLE,void**,SIZE_T*,ULONG);
NTSYSAPI NTSTATUS WINAPI NtUnmapViewOfSection(HANDLE,void*);
NTSYSAPI NTSTATUS WINAPI NtVdmControl(ULONG,void*);
NTSYSAPI NTSTATUS WINAPI NtWaitForSingleObject(HANDLE,BOOLEAN,LARGE_INTEGER*);
NTSYSAPI NTSTATUS WINAPI NtWaitForMultipleObjects(ULONG,PHANDLE,BOOLEAN,BOOLEAN,LARGE_INTEGER*);
NTSYSAPI NTSTATUS WINAPI NtWaitHighEventPair(HANDLE);
NTSYSAPI NTSTATUS WINAPI NtWaitLowEventPair(HANDLE);
NTSYSAPI NTSTATUS WINAPI NtWriteFile(HANDLE,HANDLE,PIO_APC_ROUTINE,void*,PIO_STATUS_BLOCK,void*,ULONG,PLARGE_INTEGER,PULONG);
NTSYSAPI NTSTATUS WINAPI NtWriteFileGather(HANDLE,HANDLE,PIO_APC_ROUTINE,void*,PIO_STATUS_BLOCK,FILE_SEGMENT_ELEMENT,ULONG,PLARGE_INTEGER,PULONG);
NTSYSAPI NTSTATUS WINAPI NtWriteRequestData(HANDLE,PLPC_MESSAGE,ULONG,void*,ULONG,PULONG);
NTSYSAPI NTSTATUS WINAPI NtWriteVirtualMemory(HANDLE,void*,void*,SIZE_T,SIZE_T*);
NTSYSAPI NTSTATUS WINAPI NtYieldExecution(void);
NTSYSAPI void WINAPI RtlAcquirePebLock(void);
NTSYSAPI BYTE WINAPI RtlAcquireResourceExclusive(LPRTL_RWLOCK,BYTE);
NTSYSAPI BYTE WINAPI RtlAcquireResourceShared(LPRTL_RWLOCK,BYTE);
NTSYSAPI NTSTATUS WINAPI RtlActivateActivationContext(DWORD,HANDLE,ULONG_PTR*);
NTSYSAPI NTSTATUS WINAPI RtlAddAce(PACL,DWORD,DWORD,PACE_HEADER,DWORD);
NTSYSAPI NTSTATUS WINAPI RtlAddAccessAllowedAce(PACL,DWORD,DWORD,PSID);
NTSYSAPI NTSTATUS WINAPI RtlAddAccessAllowedAceEx(PACL,DWORD,DWORD,DWORD,PSID);
NTSYSAPI NTSTATUS WINAPI RtlAddAccessDeniedAce(PACL,DWORD,DWORD,PSID);
NTSYSAPI NTSTATUS WINAPI RtlAddAccessDeniedAceEx(PACL,DWORD,DWORD,DWORD,PSID);
NTSYSAPI NTSTATUS WINAPI RtlAddAtomToAtomTable(RTL_ATOM_TABLE,WCHAR*,RTL_ATOM*);
NTSYSAPI NTSTATUS WINAPI RtlAddAuditAccessAce(PACL,DWORD,DWORD,PSID,BOOL,BOOL);
NTSYSAPI NTSTATUS WINAPI RtlAddAuditAccessAceEx(PACL,DWORD,DWORD,DWORD,PSID,BOOL,BOOL);
NTSYSAPI void WINAPI RtlAddRefActivationContext(HANDLE);
NTSYSAPI void* WINAPI RtlAddVectoredExceptionHandler(ULONG,PVECTORED_EXCEPTION_HANDLER);
NTSYSAPI NTSTATUS WINAPI RtlAdjustPrivilege(ULONG,BOOLEAN,BOOLEAN,PBOOLEAN);
NTSYSAPI NTSTATUS WINAPI RtlAllocateAndInitializeSid(PSID_IDENTIFIER_AUTHORITY,BYTE,DWORD,DWORD,DWORD,DWORD,DWORD,DWORD,DWORD,DWORD,PSI);
NTSYSAPI RTL_HANDL WINAPI RtlAllocateHandle(RTL_HANDLE_TABLE*,ULONG*);
NTSYSAPI void* WINAPI RtlAllocateHeap(HANDLE,ULONG,SIZE_T);
NTSYSAPI WCHAR WINAPI RtlAnsiCharToUnicodeChar(LPST);
NTSYSAPI DWORD WINAPI RtlAnsiStringToUnicodeSize(STRIN);
NTSYSAPI NTSTATUS WINAPI RtlAnsiStringToUnicodeString(PUNICODE_STRING,PCANSI_STRING,BOOLEAN);
NTSYSAPI NTSTATUS WINAPI RtlAppendAsciizToString(STRING,LPCSTR);
NTSYSAPI NTSTATUS WINAPI RtlAppendStringToString(STRING,STRING*);
NTSYSAPI NTSTATUS WINAPI RtlAppendUnicodeStringToString(PUNICODE_STRING,UNICODE_STRING*);
NTSYSAPI NTSTATUS WINAPI RtlAppendUnicodeToString(PUNICODE_STRING,LPCWSTR);
NTSYSAPI BOOLEAN WINAPI RtlAreAllAccessesGranted(ACCESS_MASK,ACCESS_MASK);
NTSYSAPI BOOLEAN WINAPI RtlAreAnyAccessesGranted(ACCESS_MASK,ACCESS_MASK);
NTSYSAPI BOOLEAN WINAPI RtlAreBitsSet(PCRTL_BITMAP,ULONG,ULONG);
NTSYSAPI BOOLEAN WINAPI RtlAreBitsClear(PCRTL_BITMAP,ULONG,ULONG);
NTSYSAPI NTSTATUS WINAPI RtlCharToInteger(PCSZ,ULONG,PULONG);
NTSYSAPI NTSTATUS WINAPI RtlCheckRegistryKey(ULONG, PWSTR);
NTSYSAPI void WINAPI RtlClearAllBits(PRTL_BITMAP);
NTSYSAPI void WINAPI RtlClearBits(PRTL_BITMAP,ULONG,ULONG);
NTSYSAPI NTSTATUS WINAPI RtlCreateActivationContext(PHANDLE,void*);
NTSYSAPI PDEBUG_BUFFER WINAPI RtlCreateQueryDebugBuffer(ULONG,BOOLEAN);
NTSYSAPI ULONG WINAPI RtlCompactHeap(HANDLE,ULONG);
NTSYSAPI LONG WINAPI RtlCompareString(STRING*,STRING*,BOOLEAN);
NTSYSAPI LONG WINAPI RtlCompareUnicodeString(UNICODE_STRING*,UNICODE_STRING*,BOOLEAN);
NTSYSAPI DWORD WINAPI RtlComputeCrc32(DWORD,BYTE*,INT);
NTSYSAPI NTSTATUS WINAPI RtlConvertSidToUnicodeString(PUNICODE_STRING,PSID,BOOLEAN);
NTSYSAPI LONGLONG WINAPI RtlConvertLongToLargeInteger(LONG);
NTSYSAPI ULONGLONG WINAPI RtlConvertUlongToLargeInteger(ULONG);
NTSYSAPI void WINAPI RtlCopyLuid(PLUID,LUID*);
NTSYSAPI void WINAPI RtlCopyLuidAndAttributesArray(ULONG,LUID_AND_ATTRIBUTES*,PLUID_AND_ATTRIBUTES);
NTSYSAPI BOOLEAN WINAPI RtlCopySid(DWORD,PSID,PSID);
NTSYSAPI NTSTATUS WINAPI RtlCopySecurityDescriptor(PSECURITY_DESCRIPTOR,PSECURITY_DESCRIPTOR);
NTSYSAPI void WINAPI RtlCopyString(STRING*,STRING*);
NTSYSAPI void WINAPI RtlCopyUnicodeString(UNICODE_STRING*,UNICODE_STRING*);
NTSYSAPI NTSTATUS WINAPI RtlCreateAcl(PACL,DWORD,DWORD);
NTSYSAPI NTSTATUS WINAPI RtlCreateAtomTable(ULONG,RTL_ATOM_TABLE*);
NTSYSAPI NTSTATUS WINAPI RtlCreateEnvironment(BOOLEAN, PWSTR*);
NTSYSAPI HANDLE WINAPI RtlCreateHeap(ULONG,void*,SIZE_T,SIZE_T,void*,PRTL_HEAP_DEFINITION);
NTSYSAPI NTSTATUS WINAPI RtlCreateProcessParameters(RTL_USER_PROCESS_PARAMETERS**,UNICODE_STRING*,UNICODE_STRING*,UNICODE_STRING*,UNICODE_STRING*,PWSTR,UNICODE_STRING*,UNICODE_STRING*,UNICODE_STRING*,UNICODE_STRING*);
NTSYSAPI NTSTATUS WINAPI RtlCreateSecurityDescriptor(PSECURITY_DESCRIPTOR,DWORD);
NTSYSAPI BOOLEAN WINAPI RtlCreateUnicodeString(PUNICODE_STRING,LPCWSTR);
NTSYSAPI BOOLEAN WINAPI RtlCreateUnicodeStringFromAsciiz(PUNICODE_STRING,LPCSTR);
NTSYSAPI NTSTATUS WINAPI RtlCreateUserThread(HANDLE,SECURITY_DESCRIPTOR*,BOOLEAN,void*,SIZE_T,SIZE_T,PRTL_THREAD_START_ROUTINE,void*,PHANDLE,CLIENT_ID*);
NTSYSAPI void WINAPI RtlDeactivateActivationContext(DWORD,ULONG_PTR);
NTSYSAPI NTSTATUS WINAPI RtlDeleteAce(PACL,DWORD);
NTSYSAPI NTSTATUS WINAPI RtlDeleteAtomFromAtomTable(RTL_ATOM_TABLE,RTL_ATOM);
NTSYSAPI NTSTATUS WINAPI RtlDeleteCriticalSection(RTL_CRITICAL_SECTIO);
NTSYSAPI NTSTATUS WINAPI RtlDeleteRegistryValue(ULONG, PCWSTR, PCWSTR);
NTSYSAPI void WINAPI RtlDeleteResource(LPRTL_RWLOCK);
NTSYSAPI NTSTATUS WINAPI RtlDeleteSecurityObject(PSECURITY_DESCRIPTOR*);
NTSYSAPI PRTL_USER_PROCESS_PARAMETERS WINAPI RtlDeNormalizeProcessParams(RTL_USER_PROCESS_PARAMETERS*);
NTSYSAPI NTSTATUS WINAPI RtlDestroyAtomTable(RTL_ATOM_TABLE);
NTSYSAPI NTSTATUS WINAPI RtlDestroyEnvironment(PWSTR);
NTSYSAPI NTSTATUS WINAPI RtlDestroyHandleTable(RTL_HANDLE_TABL);
NTSYSAPI HANDLE WINAPI RtlDestroyHeap(HANDLE);
NTSYSAPI void WINAPI RtlDestroyProcessParameters(RTL_USER_PROCESS_PARAMETERS*);
NTSYSAPI NTSTATUS WINAPI RtlDestroyQueryDebugBuffer(PDEBUG_BUFFER);
NTSYSAPI DOS_PATHNAME_TYPE WINAPI RtlDetermineDosPathNameType_U(PCWSTR);
NTSYSAPI BOOLEAN WINAPI RtlDllShutdownInProgress(void);
NTSYSAPI BOOLEAN WINAPI RtlDoesFileExists_U(LPCWSTR);
NTSYSAPI BOOLEAN WINAPI RtlDosPathNameToNtPathName_U(PCWSTR,PUNICODE_STRING,PWSTR*,CURDIR*);
NTSYSAPI ULONG WINAPI RtlDosSearchPath_U(LPCWSTR, LPCWSTR, LPCWSTR, ULONG, LPWSTR, LPWSTR*);
NTSYSAPI WCHAR WINAPI RtlDowncaseUnicodeChar(WCHAR);
NTSYSAPI NTSTATUS WINAPI RtlDowncaseUnicodeString(UNICODE_STRING*,UNICODE_STRING*,BOOLEAN);
NTSYSAPI void WINAPI RtlDumpResource(LPRTL_RWLOCK);
NTSYSAPI NTSTATUS WINAPI RtlDuplicateUnicodeString(int,UNICODE_STRING*,UNICODE_STRING*);
NTSYSAPI NTSTATUS WINAPI RtlEmptyAtomTable(RTL_ATOM_TABLE,BOOLEAN);
NTSYSAPI LONGLONG WINAPI RtlEnlargedIntegerMultiply(INT,INT);
NTSYSAPI ULONGLONG WINAPI RtlEnlargedUnsignedMultiply(UINT,UINT);
NTSYSAPI UINT WINAPI RtlEnlargedUnsignedDivide(ULONGLONG,UINT,UIN);
NTSYSAPI NTSTATUS WINAPI RtlEnterCriticalSection(RTL_CRITICAL_SECTIO);
NTSYSAPI void WINAPI RtlEraseUnicodeString(UNICODE_STRING*);
NTSYSAPI NTSTATUS WINAPI RtlEqualComputerName(UNICODE_STRING*,UNICODE_STRING*);
NTSYSAPI NTSTATUS WINAPI RtlEqualDomainName(UNICODE_STRING*,UNICODE_STRING*);
NTSYSAPI BOOLEAN WINAPI RtlEqualLuid(LUID*,LUID*);
NTSYSAPI BOOL WINAPI RtlEqualPrefixSid(PSID,PSID);
NTSYSAPI BOOL WINAPI RtlEqualSid(PSID,PSID);
NTSYSAPI BOOLEAN WINAPI RtlEqualString(STRING*,STRING*,BOOLEAN);
NTSYSAPI BOOLEAN WINAPI RtlEqualUnicodeString(UNICODE_STRING*,UNICODE_STRING*,BOOLEAN);
NTSYSAPI void DECLSPEC_NORETURN WINAPI RtlExitUserThread(ULONG);
NTSYSAPI NTSTATUS WINAPI RtlExpandEnvironmentStrings_U(PCWSTR, UNICODE_STRING*, UNICODE_STRING*, ULONG*);
NTSYSAPI LONGLONG WINAPI RtlExtendedMagicDivide(LONGLONG,LONGLONG,INT);
NTSYSAPI LONGLONG WINAPI RtlExtendedIntegerMultiply(LONGLONG,INT);
NTSYSAPI LONGLONG WINAPI RtlExtendedLargeIntegerDivide(LONGLONG,INT,IN);
NTSYSAPI NTSTATUS WINAPI RtlFindActivationContextSectionString(ULONG,GUID*,ULONG,UNICODE_STRING*,void*);
NTSYSAPI NTSTATUS WINAPI RtlFindCharInUnicodeString(int,UNICODE_STRING*,UNICODE_STRING*,USHORT*);
NTSYSAPI ULONG WINAPI RtlFindClearBits(PCRTL_BITMAP,ULONG,ULONG);
NTSYSAPI ULONG WINAPI RtlFindClearBitsAndSet(PRTL_BITMAP,ULONG,ULONG);
NTSYSAPI ULONG WINAPI RtlFindClearRuns(PCRTL_BITMAP,PRTL_BITMAP_RUN,ULONG,BOOLEAN);
NTSYSAPI ULONG WINAPI RtlFindLastBackwardRunSet(PCRTL_BITMAP,ULONG,PULONG);
NTSYSAPI ULONG WINAPI RtlFindLastBackwardRunClear(PCRTL_BITMAP,ULONG,PULONG);
NTSYSAPI CCHAR WINAPI RtlFindLeastSignificantBit(ULONGLONG);
NTSYSAPI ULONG WINAPI RtlFindLongestRunSet(PCRTL_BITMAP,PULONG);
NTSYSAPI ULONG WINAPI RtlFindLongestRunClear(PCRTL_BITMAP,PULONG);
NTSYSAPI NTSTATUS WINAPI RtlFindMessage(HMODULE,ULONG,ULONG,ULONG,MESSAGE_RESOURCE_ENTRY**);
NTSYSAPI CCHAR WINAPI RtlFindMostSignificantBit(ULONGLONG);
NTSYSAPI ULONG WINAPI RtlFindNextForwardRunSet(PCRTL_BITMAP,ULONG,PULONG);
NTSYSAPI ULONG WINAPI RtlFindNextForwardRunClear(PCRTL_BITMAP,ULONG,PULONG);
NTSYSAPI ULONG WINAPI RtlFindSetBits(PCRTL_BITMAP,ULONG,ULONG);
NTSYSAPI ULONG WINAPI RtlFindSetBitsAndClear(PRTL_BITMAP,ULONG,ULONG);
NTSYSAPI ULONG WINAPI RtlFindSetRuns(PCRTL_BITMAP,PRTL_BITMAP_RUN,ULONG,BOOLEAN);
NTSYSAPI BOOLEAN WINAPI RtlFirstFreeAce(PACL,PACE_HEADE);
NTSYSAPI NTSTATUS WINAPI RtlFormatCurrentUserKeyPath(PUNICODE_STRING);
NTSYSAPI NTSTATUS WINAPI RtlFormatMessage(LPWSTR,UCHAR,BOOLEAN,BOOLEAN,BOOLEAN,va_lis,LPWSTR,ULONG);
NTSYSAPI void WINAPI RtlFreeAnsiString(PANSI_STRING);
NTSYSAPI BOOLEAN WINAPI RtlFreeHandle(RTL_HANDLE_TABL,RTL_HANDLE*);
NTSYSAPI BOOLEAN WINAPI RtlFreeHeap(HANDLE,ULONG,void*);
NTSYSAPI void WINAPI RtlFreeOemString(POEM_STRING);
NTSYSAPI DWORD WINAPI RtlFreeSid(PSID);
NTSYSAPI void WINAPI RtlFreeThreadActivationContextStack(void);
NTSYSAPI void WINAPI RtlFreeUnicodeString(PUNICODE_STRING);
NTSYSAPI NTSTATUS WINAPI RtlGetAce(PACL,DWORD,void**);
NTSYSAPI NTSTATUS WINAPI RtlGetActiveActivationContext(PHANDLE);
NTSYSAPI NTSTATUS WINAPI RtlGetControlSecurityDescriptor(PSECURITY_DESCRIPTOR, PSECURITY_DESCRIPTOR_CONTROL,LPDWORD);
NTSYSAPI NTSTATUS WINAPI RtlGetCurrentDirectory_U(ULONG, LPWSTR);
NTSYSAPI PE WINAPI RtlGetCurrentPeb(void);
NTSYSAPI NTSTATUS WINAPI RtlGetDaclSecurityDescriptor(PSECURITY_DESCRIPTOR,PBOOLEAN,PAC,PBOOLEAN);
NTSYSAPI ULONG WINAPI RtlGetFullPathName_U(PCWSTR,ULONG,PWSTR,PWSTR*);
NTSYSAPI NTSTATUS WINAPI RtlGetGroupSecurityDescriptor(PSECURITY_DESCRIPTOR,PSI,PBOOLEAN);
NTSYSAPI NTSTATUS WINAPI RtlGetLastNtStatus(void);
NTSYSAPI DWORD WINAPI RtlGetLastWin32Error(void);
NTSYSAPI DWORD WINAPI RtlGetLongestNtPathLength(void);
NTSYSAPI BOOLEAN WINAPI RtlGetNtProductType(LPDWORD);
NTSYSAPI NTSTATUS WINAPI RtlGetOwnerSecurityDescriptor(PSECURITY_DESCRIPTOR,PSI,PBOOLEAN);
NTSYSAPI ULONG WINAPI RtlGetProcessHeaps(ULONG,PHANDLE);
NTSYSAPI NTSTATUS WINAPI RtlGetSaclSecurityDescriptor(PSECURITY_DESCRIPTOR,PBOOLEAN,PAC,PBOOLEAN);
NTSYSAPI NTSTATUS WINAPI RtlGetVersion(RTL_OSVERSIONINFOEXW*);
NTSYSAPI NTSTATUS WINAPI RtlGUIDFromString(PUNICODE_STRING,GUID*);
NTSYSAPI PSID_IDENTIFIER_AUTHORITY WINAPI RtlIdentifierAuthoritySid(PSID);
NTSYSAPI void* WINAPI RtlImageDirectoryEntryToData(HMODULE,BOOL,WORD,ULON);
NTSYSAPI PIMAGE_NT_HEADERS WINAPI RtlImageNtHeader(HMODULE);
NTSYSAPI PIMAGE_SECTION_HEADER WINAPI RtlImageRvaToSection(IMAGE_NT_HEADER,HMODULE,DWORD);
NTSYSAPI void* WINAPI RtlImageRvaToVa(IMAGE_NT_HEADER,HMODULE,DWORD,IMAGE_SECTION_HEADER**);
NTSYSAPI NTSTATUS WINAPI RtlImpersonateSelf(SECURITY_IMPERSONATION_LEVEL);
NTSYSAPI void WINAPI RtlInitString(PSTRING,PCSZ);
NTSYSAPI void WINAPI RtlInitAnsiString(PANSI_STRING,PCSZ);
NTSYSAPI NTSTATUS WINAPI RtlInitAnsiStringEx(PANSI_STRING,PCSZ);
NTSYSAPI void WINAPI RtlInitUnicodeString(PUNICODE_STRING,PCWSTR);
NTSYSAPI NTSTATUS WINAPI RtlInitUnicodeStringEx(PUNICODE_STRING,PCWSTR);
NTSYSAPI NTSTATUS WINAPI RtlInitializeCriticalSection(RTL_CRITICAL_SECTIO);
NTSYSAPI NTSTATUS WINAPI RtlInitializeCriticalSectionAndSpinCount(RTL_CRITICAL_SECTIO,DWORD);
NTSYSAPI void WINAPI RtlInitializeBitMap(PRTL_BITMAP,PULONG,ULONG);
NTSYSAPI void WINAPI RtlInitializeHandleTable(ULONG,ULONG,RTL_HANDLE_TABL);
NTSYSAPI void WINAPI RtlInitializeResource(LPRTL_RWLOCK);
NTSYSAPI BOOL WINAPI RtlInitializeSid(PSID,PSID_IDENTIFIER_AUTHORITY,BYTE);
NTSYSAPI NTSTATUS WINAPI RtlInt64ToUnicodeString(ULONGLONG,ULONG,PUNICODE_STRING);
NTSYSAPI NTSTATUS WINAPI RtlIntegerToChar(ULONG,ULONG,ULONG,PCHAR);
NTSYSAPI NTSTATUS WINAPI RtlIntegerToUnicodeString(ULONG,ULONG,PUNICODE_STRING);
NTSYSAPI BOOLEAN WINAPI RtlIsActivationContextActive(HANDLE);
NTSYSAPI ULONG WINAPI RtlIsDosDeviceName_U(PCWSTR);
NTSYSAPI BOOLEAN WINAPI RtlIsNameLegalDOS8Dot3(UNICODE_STRING*,POEM_STRING,PBOOLEAN);
NTSYSAPI BOOLEAN WINAPI RtlIsTextUnicode(void*,INT,IN);
NTSYSAPI BOOLEAN WINAPI RtlIsValidHandle(RTL_HANDLE_TABL, RTL_HANDLE*);
NTSYSAPI BOOLEAN WINAPI RtlIsValidIndexHandle(RTL_HANDLE_TABL, ULONG Index, RTL_HANDLE**);
NTSYSAPI LONGLONG WINAPI RtlLargeIntegerAdd(LONGLONG,LONGLONG);
NTSYSAPI LONGLONG WINAPI RtlLargeIntegerArithmeticShift(LONGLONG,INT);
NTSYSAPI ULONGLONG WINAPI RtlLargeIntegerDivide( ULONGLONG,ULONGLONG,ULONGLON);
NTSYSAPI LONGLONG WINAPI RtlLargeIntegerNegate(LONGLONG);
NTSYSAPI LONGLONG WINAPI RtlLargeIntegerShiftLeft(LONGLONG,INT);
NTSYSAPI LONGLONG WINAPI RtlLargeIntegerShiftRight(LONGLONG,INT);
NTSYSAPI LONGLONG WINAPI RtlLargeIntegerSubtract(LONGLONG,LONGLONG);
NTSYSAPI NTSTATUS WINAPI RtlLargeIntegerToChar(ULONGLON,ULONG,ULONG,PCHAR);
NTSYSAPI NTSTATUS WINAPI RtlLeaveCriticalSection(RTL_CRITICAL_SECTIO);
NTSYSAPI DWORD WINAPI RtlLengthRequiredSid(DWORD);
NTSYSAPI ULONG WINAPI RtlLengthSecurityDescriptor(PSECURITY_DESCRIPTOR);
NTSYSAPI DWORD WINAPI RtlLengthSid(PSID);
NTSYSAPI NTSTATUS WINAPI RtlLocalTimeToSystemTime(LARGE_INTEGER*,PLARGE_INTEGER);
NTSYSAPI BOOLEAN WINAPI RtlLockHeap(HANDLE);
NTSYSAPI NTSTATUS WINAPI RtlLookupAtomInAtomTable(RTL_ATOM_TABLE,WCHAR*,RTL_ATOM*);
NTSYSAPI NTSTATUS WINAPI RtlMakeSelfRelativeSD(PSECURITY_DESCRIPTOR,PSECURITY_DESCRIPTOR,LPDWORD);
NTSYSAPI void WINAPI RtlMapGenericMask(PACCESS_MASK,GENERIC_MAPPING*);
NTSYSAPI NTSTATUS WINAPI RtlMultiByteToUnicodeN(LPWSTR,DWORD,LPDWORD,LPCSTR,DWORD);
NTSYSAPI NTSTATUS WINAPI RtlMultiByteToUnicodeSize(DWORD*,LPCSTR,UINT);
NTSYSAPI NTSTATUS WINAPI RtlNewSecurityObject(PSECURITY_DESCRIPTOR,PSECURITY_DESCRIPTOR,PSECURITY_DESCRIPTOR*,BOOLEAN,HANDLE,PGENERIC_MAPPING);
NTSYSAPI PRTL_USER_PROCESS_PARAMETERS WINAPI RtlNormalizeProcessParams(RTL_USER_PROCESS_PARAMETERS*);
NTSYSAPI ULONG WINAPI RtlNtStatusToDosError(NTSTATUS);
NTSYSAPI ULONG WINAPI RtlNtStatusToDosErrorNoTeb(NTSTATUS);
NTSYSAPI ULONG WINAPI RtlNumberOfSetBits(PCRTL_BITMAP);
NTSYSAPI ULONG WINAPI RtlNumberOfClearBits(PCRTL_BITMAP);
NTSYSAPI UINT WINAPI RtlOemStringToUnicodeSize(STRING*);
NTSYSAPI NTSTATUS WINAPI RtlOemStringToUnicodeString(UNICODE_STRING*,STRING*,BOOLEAN);
NTSYSAPI NTSTATUS WINAPI RtlOemToUnicodeN(LPWSTR,DWORD,LPDWORD,LPCSTR,DWORD);
NTSYSAPI NTSTATUS WINAPI RtlOpenCurrentUser(ACCESS_MASK,PHANDLE);
NTSYSAPI void* WINAPI RtlPcToFileHeader(void*,void**);
NTSYSAPI NTSTATUS WINAPI RtlPinAtomInAtomTable(RTL_ATOM_TABLE,RTL_ATOM);
NTSYSAPI BOOLEAN WINAPI RtlPrefixString(STRING*,STRING*,BOOLEAN);
NTSYSAPI BOOLEAN WINAPI RtlPrefixUnicodeString(UNICODE_STRING*,UNICODE_STRING*,BOOLEAN);
NTSYSAPI NTSTATUS WINAPI RtlQueryAtomInAtomTable(RTL_ATOM_TABLE,RTL_ATOM,ULONG*,ULONG*,WCHAR*,ULONG*);
NTSYSAPI NTSTATUS WINAPI RtlQueryEnvironmentVariable_U(PWSTR,PUNICODE_STRING,PUNICODE_STRING);
NTSYSAPI NTSTATUS WINAPI RtlQueryInformationAcl(PACL,void*,DWORD,ACL_INFORMATION_CLASS);
NTSYSAPI NTSTATUS WINAPI RtlQueryInformationActivationContext(ULONG,HANDLE,void*,ULONG,void*,SIZE_T,SIZE_T*);
NTSYSAPI NTSTATUS WINAPI RtlQueryProcessDebugInformation(ULONG,ULONG,PDEBUG_BUFFER);
NTSYSAPI NTSTATUS WINAPI RtlQueryRegistryValues(ULONG, PCWSTR, PRTL_QUERY_REGISTRY_TABLE, void*, void*);
NTSYSAPI NTSTATUS WINAPI RtlQueryTimeZoneInformation(RTL_TIME_ZONE_INFORMATION*);
NTSYSAPI NTSTATUS WINAPI RtlQueueWorkItem(PRTL_WORK_ITEM_ROUTINE,void*,ULONG);
NTSYSAPI void WINAPI RtlRaiseException(PEXCEPTION_RECORD);
NTSYSAPI void WINAPI RtlRaiseStatus(NTSTATUS);
NTSYSAPI ULONG WINAPI RtlRandom(PULONG);
NTSYSAPI void* WINAPI RtlReAllocateHeap(HANDLE,ULONG,void*,SIZE_T);
NTSYSAPI void WINAPI RtlReleaseActivationContext(HANDLE);
NTSYSAPI void WINAPI RtlReleasePebLock(void);
NTSYSAPI void WINAPI RtlReleaseResource(LPRTL_RWLOCK);
NTSYSAPI ULONG WINAPI RtlRemoveVectoredExceptionHandler(void*);
NTSYSAPI void WINAPI RtlRestoreLastWin32Error(DWORD);
NTSYSAPI void WINAPI RtlSecondsSince1970ToTime(DWORD,LARGE_INTEGE);
NTSYSAPI void WINAPI RtlSecondsSince1980ToTime(DWORD,LARGE_INTEGE);
NTSYSAPI NTSTATUS WINAPI RtlSelfRelativeToAbsoluteSD(PSECURITY_DESCRIPTOR,PSECURITY_DESCRIPTOR,PDWORD,PACL,PDWORD,PACL,PDWORD,PSID,PDWORD,PSID,PDWORD);
NTSYSAPI void WINAPI RtlSetAllBits(PRTL_BITMAP);
NTSYSAPI void WINAPI RtlSetBits(PRTL_BITMAP,ULONG,ULONG);
NTSYSAPI ULONG WINAPI RtlSetCriticalSectionSpinCount(RTL_CRITICAL_SECTION*,ULONG);
NTSYSAPI NTSTATUS WINAPI RtlSetControlSecurityDescriptor(PSECURITY_DESCRIPTOR,SECURITY_DESCRIPTOR_CONTROL,SECURITY_DESCRIPTOR_CONTROL);
NTSYSAPI NTSTATUS WINAPI RtlSetCurrentDirectory_U(UNICODE_STRING*);
NTSYSAPI void WINAPI RtlSetCurrentEnvironment(PWSTR, PWSTR*);
NTSYSAPI NTSTATUS WINAPI RtlSetDaclSecurityDescriptor(PSECURITY_DESCRIPTOR,BOOLEAN,PACL,BOOLEAN);
NTSYSAPI NTSTATUS WINAPI RtlSetEnvironmentVariable(PWSTR*,PUNICODE_STRING,PUNICODE_STRING);
NTSYSAPI NTSTATUS WINAPI RtlSetOwnerSecurityDescriptor(PSECURITY_DESCRIPTOR,PSID,BOOLEAN);
NTSYSAPI NTSTATUS WINAPI RtlSetGroupSecurityDescriptor(PSECURITY_DESCRIPTOR,PSID,BOOLEAN);
NTSYSAPI void WINAPI RtlSetLastWin32Error(DWORD);
NTSYSAPI void WINAPI RtlSetLastWin32ErrorAndNtStatusFromNtStatus(NTSTATUS);
NTSYSAPI NTSTATUS WINAPI RtlSetSaclSecurityDescriptor(PSECURITY_DESCRIPTOR,BOOLEAN,PACL,BOOLEAN);
NTSYSAPI NTSTATUS WINAPI RtlSetTimeZoneInformation(RTL_TIME_ZONE_INFORMATION*);
NTSYSAPI SIZE_T WINAPI RtlSizeHeap(HANDLE,ULONG,void*);
NTSYSAPI NTSTATUS WINAPI RtlStringFromGUID(REFGUID,PUNICODE_STRING);
NTSYSAPI LPDWORD WINAPI RtlSubAuthoritySid(PSID,DWORD);
NTSYSAPI LPBYTE WINAPI RtlSubAuthorityCountSid(PSID);
NTSYSAPI NTSTATUS WINAPI RtlSystemTimeToLocalTime(LARGE_INTEGER*,PLARGE_INTEGER);
NTSYSAPI void WINAPI RtlTimeToTimeFields(LARGE_INTEGER*,PTIME_FIELDS);
NTSYSAPI BOOLEAN WINAPI RtlTimeFieldsToTime(PTIME_FIELDS,PLARGE_INTEGER);
NTSYSAPI void WINAPI RtlTimeToElapsedTimeFields(LARGE_INTEGE,PTIME_FIELDS);
NTSYSAPI BOOLEAN WINAPI RtlTimeToSecondsSince1970(LARGE_INTEGE,LPDWORD);
NTSYSAPI BOOLEAN WINAPI RtlTimeToSecondsSince1980(LARGE_INTEGE,LPDWORD);
NTSYSAPI BOOL WINAPI RtlTryEnterCriticalSection(RTL_CRITICAL_SECTIO);
NTSYSAPI ULONGLONG __cdecl RtlUlonglongByteSwap(ULONGLONG);
NTSYSAPI DWORD WINAPI RtlUnicodeStringToAnsiSize(UNICODE_STRING*);
NTSYSAPI NTSTATUS WINAPI RtlUnicodeStringToAnsiString(PANSI_STRING,PCUNICODE_STRING,BOOLEAN);
NTSYSAPI NTSTATUS WINAPI RtlUnicodeStringToInteger(PUNICODE_STRING,ULONG,ULONG*);
NTSYSAPI DWORD WINAPI RtlUnicodeStringToOemSize(UNICODE_STRING*);
NTSYSAPI NTSTATUS WINAPI RtlUnicodeStringToOemString(POEM_STRING,PCUNICODE_STRING,BOOLEAN);
NTSYSAPI NTSTATUS WINAPI RtlUnicodeToMultiByteN(LPSTR,DWORD,LPDWORD,LPCWSTR,DWORD);
NTSYSAPI NTSTATUS WINAPI RtlUnicodeToMultiByteSize(PULONG,PCWSTR,ULONG);
NTSYSAPI NTSTATUS WINAPI RtlUnicodeToOemN(LPSTR,DWORD,LPDWORD,LPCWSTR,DWORD);
NTSYSAPI ULONG WINAPI RtlUniform(PULONG);
NTSYSAPI BOOLEAN WINAPI RtlUnlockHeap(HANDLE);
NTSYSAPI void WINAPI RtlUnwind(void*,void*,PEXCEPTION_RECORD,void*);
NTSYSAPI void WINAPI RtlUnwind2(FRAME_POINTERS,void*,PEXCEPTION_RECORD,void*,PCONTEXT);
NTSYSAPI void WINAPI RtlUnwindEx(FRAME_POINTERS,void*,PEXCEPTION_RECORD,void*,PCONTEXT,PUNWIND_HISTORY_TABLE);
NTSYSAPI WCHAR WINAPI RtlUpcaseUnicodeChar(WCHAR);
NTSYSAPI NTSTATUS WINAPI RtlUpcaseUnicodeString(UNICODE_STRING*,PUNICODE_STRING,BOOLEAN);
NTSYSAPI NTSTATUS WINAPI RtlUpcaseUnicodeStringToAnsiString(STRING*,UNICODE_STRING*,BOOLEAN);
NTSYSAPI NTSTATUS WINAPI RtlUpcaseUnicodeStringToCountedOemString(STRING*,UNICODE_STRING*,BOOLEAN);
NTSYSAPI NTSTATUS WINAPI RtlUpcaseUnicodeStringToOemString(STRING*,UNICODE_STRING*,BOOLEAN);
NTSYSAPI NTSTATUS WINAPI RtlUpcaseUnicodeToMultiByteN(LPSTR,DWORD,LPDWORD,LPCWSTR,DWORD);
NTSYSAPI NTSTATUS WINAPI RtlUpcaseUnicodeToOemN(LPSTR,DWORD,LPDWORD,LPCWSTR,DWORD);
NTSYSAPI CHAR WINAPI RtlUpperChar(CHAR);
NTSYSAPI void WINAPI RtlUpperString(STRIN,STRING*);
NTSYSAPI NTSTATUS WINAPI RtlValidSecurityDescriptor(PSECURITY_DESCRIPTOR);
NTSYSAPI BOOLEAN WINAPI RtlValidAcl(PACL);
NTSYSAPI BOOLEAN WINAPI RtlValidSid(PSID);
NTSYSAPI BOOLEAN WINAPI RtlValidateHeap(HANDLE,ULONG,void*);
NTSYSAPI NTSTATUS WINAPI RtlVerifyVersionInfo(RTL_OSVERSIONINFOEXW*,DWORD,DWORDLONG);
NTSYSAPI NTSTATUS WINAPI RtlWalkHeap(HANDLE,void*);
NTSYSAPI NTSTATUS WINAPI RtlWriteRegistryValue(ULONG,PCWSTR,PCWSTR,ULONG,void*,ULONG);
NTSYSAPI NTSTATUS WINAPI RtlpNtCreateKey(PHANDLE,ACCESS_MASK,OBJECT_ATTRIBUTES*,ULONG,UNICODE_STRING*,ULONG,PULONG);
NTSYSAPI NTSTATUS WINAPI RtlpNtEnumerateSubKey(HANDLE,PUNICODE_STRING, ULONG);
NTSYSAPI NTSTATUS WINAPI RtlpWaitForCriticalSection(RTL_CRITICAL_SECTIO);
NTSYSAPI NTSTATUS WINAPI RtlpUnWaitCriticalSection(RTL_CRITICAL_SECTIO);